CompTIA Linux+ (XK0-006)

Question 1

You need to add a new vendor package repository to a RHEL 9 server so that packages from it are permanently available to dnf. The vendor provides a repository at https://repo.vendor.example/rhel9/. Which command adds this repository persistently to the system's dnf configuration?

Accepted Answer

dnf config-manager --add-repo https://repo.vendor.example/rhel9/

Answer

dnf install https://repo.vendor.example/rhel9/

Answer

dnf --repofrompath=vendor,https://repo.vendor.example/rhel9/ update

Answer

dnf makecache https://repo.vendor.example/rhel9/

Question 2

You added a new administrator, jsmith, to the 'wheel' group with 'usermod -aG wheel jsmith' on a RHEL 9 system where wheel is granted sudo access via /etc/sudoers. jsmith is currently logged in via SSH but reports that 'sudo' commands still fail with a 'not in sudoers' error. What is the most likely reason and correct action?

Accepted Answer

The group change does not apply to jsmith's existing session; they must log out and back in (or start a new login session) to acquire the new group membership.

Answer

The usermod command replaced all of jsmith's groups; you must re-run it with the -G flag listing every group.

Answer

You must restart the sshd service so it re-reads /etc/group before the membership takes effect.

Answer

You must run 'systemctl restart sudo' to reload the sudoers database and apply the new group.

Question 3

An Ansible playbook runs as the unprivileged user 'deploy' via SSH. One task must install a package with the 'dnf' module, which requires root. The playbook connection succeeds, but the package task fails with a permissions error. Which change to the failing task correctly escalates privileges to root using sudo?

Accepted Answer

Add 'become: true' (with 'become_method: sudo') to the task or play

Answer

Add 'remote_user: root' to the task

Answer

Set 'connection: local' on the play

Answer

Add 'gather_facts: true' to the play

Question 4

Before applying a large Ansible playbook to 40 production web servers, a DevOps engineer wants to preview exactly which tasks would report a change without actually modifying any managed node. Which ansible-playbook invocation accomplishes this dry run?

Accepted Answer

ansible-playbook site.yml --check

Answer

ansible-playbook site.yml --syntax-check

Answer

ansible-playbook site.yml --list-tasks

Answer

ansible-playbook site.yml --start-at-task=first

Question 5

You are writing an Ansible playbook that installs the Apache web server on a mixed fleet of servers. RHEL-based hosts need the 'httpd' package while Debian-based hosts need 'apache2'. You want a single task that installs the correct package based on the target host's distribution, using facts automatically collected at the start of the play. Which conditional expression should you attach to the install task?

Accepted Answer

when: ansible_facts['os_family'] == "RedHat"

Answer

when: ansible_os_family is "RedHat"

Answer

when: {{ ansible_facts['os_family'] }} == RedHat

Answer

only_if: os_family == RedHat

Question 6

You are writing an Ansible playbook that deploys an updated Nginx configuration file with the 'template' module. Nginx should only be restarted when the configuration file actually changes, not on every playbook run. Which approach correctly implements this behavior?

Accepted Answer

Add 'notify: restart nginx' to the template task and define a handler named 'restart nginx' that restarts the service

Answer

Add a separate task that always runs 'service nginx restart' after the template task

Answer

Set 'changed_when: true' on the template task so Nginx restarts every time

Answer

Use the 'ignore_errors: yes' directive on the template task to force a restart

Question 7

An Ansible playbook manages a fleet of web servers. A team member added a task that runs a shell command to regenerate a config cache. Every playbook run reports this task as 'changed', even when nothing was actually modified, which triggers an unnecessary handler that restarts the web service. Which approach BEST makes this task idempotent so it only reports 'changed' when the cache is truly rebuilt?

Accepted Answer

Add a 'changed_when' condition to the shell task that evaluates the command's output or return code to reflect actual changes

Answer

Add 'ignore_errors: true' to the shell task so failures do not trigger the handler

Answer

Move the handler into the same task using 'notify' with 'listen' so it always fires last

Answer

Set 'gather_facts: false' at the play level to prevent Ansible from detecting changes

Question 8

An Ansible playbook installs several packages using a loop and registers the output. A teammate wants a subsequent task to print the name of each package that was actually installed (changed), skipping packages that were already present. Which construct correctly iterates over the registered results to access per-item status?

Accepted Answer

Loop over the registered variable's '.results' list and reference each element's '.changed' and '.item' attributes

Answer

Reference the registered variable's top-level '.changed' attribute inside a single debug task

Answer

Use 'with_items' on the original package list and reference 'ansible_facts.packages' for status

Answer

Loop over the registered variable directly, since a looped task stores each result as a top-level key

Question 9

You maintain an Ansible playbook that deploys a web application. The playbook references a variables file, group_vars/prod/secrets.yml, containing a database password in plaintext. Your security team requires that this file be encrypted at rest in the Git repository but still usable during automated playbook runs. Which approach meets these requirements?

Accepted Answer

Run 'ansible-vault encrypt group_vars/prod/secrets.yml' and execute the playbook with '--ask-vault-pass' or a '--vault-password-file'

Answer

Base64-encode the secrets.yml file with 'base64 secrets.yml > secrets.yml.b64' and reference the encoded file in the playbook

Answer

Add 'group_vars/prod/secrets.yml' to .gitignore so the plaintext file is never committed to the repository

Answer

Set 'no_log: true' on every task that uses the password so the value is hidden from output

Question 10

An application confined by AppArmor on an Ubuntu server is being denied access to a legitimate log directory, and users report failures. You need to temporarily allow the application to run while logging what it attempts to access, without fully disabling AppArmor protection for other profiles. Which command accomplishes this for the profile named /usr/sbin/myapp?

Accepted Answer

aa-complain /usr/sbin/myapp

Answer

aa-disable /usr/sbin/myapp

Answer

aa-enforce /usr/sbin/myapp

Answer

systemctl stop apparmor

Question 11

A database administrator runs a legacy application that only works with a specific version of the 'libmariadb3' package on a Debian-based server. During routine 'apt upgrade' operations, the package keeps getting updated, breaking the application. Which command should be used to prevent this specific package from being upgraded while allowing all other packages to update normally?

Accepted Answer

apt-mark hold libmariadb3

Answer

apt remove --purge libmariadb3

Answer

dpkg --ignore-depends=libmariadb3

Answer

apt-mark auto libmariadb3

Question 12

After a suspected brute-force attempt, a security analyst must produce a summary report of all failed authentication events recorded by the Linux audit daemon on a RHEL 9 server. The analyst wants a high-level tally rather than raw event records. Which command produces this summary?

Accepted Answer

aureport -au --failed

Answer

ausearch -m USER_LOGIN --raw

Answer

auditctl -l | grep login

Answer

journalctl -u auditd --since today

Question 13

A security analyst configured an audit rule with the key 'passwd-changes' to monitor modifications to /etc/passwd. After a suspected unauthorized change, they need to review only the audit events associated with that rule from the audit logs. Which command should they run?

Accepted Answer

ausearch -k passwd-changes

Answer

auditctl -l passwd-changes

Answer

aureport --file /etc/passwd

Answer

grep passwd-changes /var/log/messages

Question 14

During a CIS-style security baseline review, you must produce a list of all files on the root filesystem that have the setuid bit set, so the security team can verify each one against an approved allowlist. The scan must not descend into other mounted filesystems. Which command accomplishes this?

Accepted Answer

find / -xdev -perm -4000 -type f

Answer

find / -perm -2000 -type f

Answer

find / -xdev -perm 4000 -type f

Answer

ls -lR / | grep '^-rws'

Question 15

A systems administrator is writing a Bash maintenance script that accepts a single argument ($1) representing an action: 'start', 'stop', or 'restart'. Any other value should print an error and exit with status 1. The administrator wants the cleanest, most readable construct that matches the argument against these fixed string patterns. Which snippet correctly implements this behavior?

Accepted Answer

case "$1" in
  start) echo "starting" ;;
  stop) echo "stopping" ;;
  restart) echo "restarting" ;;
  *) echo "invalid"; exit 1 ;;
esac

Answer

case $1 in
  start) echo "starting"
  stop) echo "stopping"
  restart) echo "restarting"
  *) echo "invalid"; exit 1
done

Answer

switch ("$1") {
  case start: echo "starting"; break;
  case stop: echo "stopping"; break;
  default: echo "invalid"; exit 1;
}

Answer

if [ "$1" = start | stop | restart ]; then
  echo "$1"
else
  echo "invalid"; exit 1
fi

Question 16

A colleague wrote a Bash script with a function that computes a value and stores it in a variable named 'result'. After the function runs, the main script uses '$result' but keeps getting the wrong value because an unrelated global variable also named 'result' is being overwritten by the function. What is the BEST way to fix the function so it does not clobber the global variable while still returning its computed value to the caller?

Accepted Answer

Declare the variable inside the function with 'local result', then output the value with 'echo' and capture it in the caller using command substitution

Answer

Add 'export result' inside the function so the variable is isolated to the function's environment

Answer

Use 'return $result' at the end of the function and read the value from '$?' in the caller

Answer

Prefix the function call with 'set -o nounset' so undefined variables are protected from being overwritten

Question 17

You are writing a provisioning script that must create an application config file. The file needs to embed the value of the shell variable $APP_PORT while writing multiple lines to /etc/myapp/app.conf in a single command. Which construct correctly writes the block, with variable expansion, to the file?

Accepted Answer

cat << EOF > /etc/myapp/app.conf
listen_port=$APP_PORT
log_level=info
EOF

Answer

cat << 'EOF' > /etc/myapp/app.conf
listen_port=$APP_PORT
log_level=info
EOF

Answer

cat < EOF > /etc/myapp/app.conf
listen_port=$APP_PORT
log_level=info
EOF

Answer

echo << EOF >> /etc/myapp/app.conf listen_port=$APP_PORT log_level=info EOF

Question 18

A backup script must process a list of directory paths, some of which contain spaces (e.g., '/data/project files'). The current code fails, treating each word as a separate item:

```bash
DIRS="/data/project files /var/log /srv/web root"
for d in $DIRS; do
  tar -czf "/backup/$(basename "$d").tgz" "$d"
done
```

Which change correctly handles paths containing spaces?

Accepted Answer

Declare the paths as a Bash array and iterate with quoted expansion: DIRS=("/data/project files" "/var/log" "/srv/web root") and for d in "${DIRS[@]}"; do

Answer

Wrap the variable in double quotes in the loop header: for d in "$DIRS"; do

Answer

Set IFS to a comma and keep the string variable: IFS=',' before the loop

Answer

Escape the loop variable with backslashes: for d in \$DIRS; do

Question 19

A DevOps engineer writes a Bash script that must process a list of hostnames from a file called servers.txt. For each host, it should attempt an SSH connection test and print 'UP' only if the connection succeeds. The current loop always prints 'UP' regardless of connectivity:

while read host; do
  ssh -o ConnectTimeout=5 "$host" exit
  echo "$host UP"
done < servers.txt

Which modification correctly prints 'UP' only when the SSH command succeeds?

Accepted Answer

Wrap the ssh command in an if statement: if ssh -o ConnectTimeout=5 "$host" exit; then echo "$host UP"; fi

Answer

Change the echo line to: echo "$host UP" || ssh -o ConnectTimeout=5 "$host" exit

Answer

Add set -e at the top of the script so the loop stops when SSH fails

Answer

Test the variable with: if [ "$host" ]; then echo "$host UP"; fi

Question 20

A backup script must use the value of the environment variable BACKUP_DIR if it is set, but fall back to /var/backups if the variable is unset or empty, without permanently assigning the variable. Which line accomplishes this correctly?

Accepted Answer

TARGET="${BACKUP_DIR:-/var/backups}"

Answer

TARGET="${BACKUP_DIR:=/var/backups}"

Answer

TARGET="${BACKUP_DIR:?/var/backups}"

Answer

TARGET="${BACKUP_DIR:+/var/backups}"

Question 21

You are writing a deployment script that accepts a variable number of hostnames as command-line arguments. After processing the first argument (a flag like --restart), you want to loop through the remaining arguments as hostnames. Which construct correctly removes the first positional parameter so that $@ contains only the remaining hostnames?

Accepted Answer

shift

Answer

unset $1

Answer

$@=${@:1}

Answer

pop $1

Question 22

A DevOps engineer needs a Bash script to process a file named servers.txt that contains one hostname per line, including some lines with embedded spaces and trailing whitespace. Each hostname must be read exactly as written and passed to a ping check. Which loop construct correctly reads the file line by line while preserving leading/trailing whitespace and avoiding word splitting?

Accepted Answer

while IFS= read -r line; do ping -c1 "$line"; done < servers.txt

Answer

for line in $(cat servers.txt); do ping -c1 $line; done

Answer

while read line; do ping -c1 $line; done < servers.txt

Answer

cat servers.txt | for line; do ping -c1 "$line"; done

Question 23

A deployment script silently continues after a failed command in the middle of a pipeline, leaving the system in an inconsistent state. A colleague reports that even when a step like 'curl ... | tar xz' fails at the curl stage, the script still exits 0 and proceeds. You want the script to abort immediately on any command failure, including failures anywhere in a pipeline, and treat unset variables as errors. Which line should you add near the top of the script?

Accepted Answer

set -euo pipefail

Answer

set -x

Answer

trap 'exit 0' ERR

Answer

shopt -s nullglob

Question 24

A backup script creates a temporary working directory with mktemp -d and stores its path in the variable WORKDIR. The script may exit at several points due to errors, and each early exit currently leaves behind orphaned temp directories in /tmp. You must guarantee the temp directory is removed whenever the script terminates, regardless of how it exits. Which line should you add near the top of the script?

Accepted Answer

trap 'rm -rf "$WORKDIR"' EXIT

Answer

at rm -rf "$WORKDIR" now

Answer

trap 'rm -rf "$WORKDIR"' SIGKILL

Answer

rm -rf "$WORKDIR" && exit 0

Question 25

You are writing a deployment script that must pause until a backend service responds successfully to a health check before continuing. The command 'curl -sf http://localhost:8080/health' returns exit status 0 when the service is healthy and non-zero otherwise. You want the script to keep retrying (with a 2-second pause between attempts) and only proceed once the check succeeds. Which loop construct correctly accomplishes this?

Accepted Answer

until curl -sf http://localhost:8080/health; do sleep 2; done

Answer

while curl -sf http://localhost:8080/health; do sleep 2; done

Answer

until [ curl -sf http://localhost:8080/health ]; do sleep 2; done

Answer

for curl -sf http://localhost:8080/health; do sleep 2; done

Question 26

You administer a BIND9 authoritative DNS server for the zone example.com. After adding a new A record to /var/named/example.com.zone and incrementing the SOA serial number, remote resolvers and secondary name servers still return the old data. The service is running and no errors appear in the journal. Which command should you run to have the primary server reload the updated zone file without restarting the entire daemon?

Accepted Answer

rndc reload example.com

Answer

systemctl restart NetworkManager

Answer

dig @localhost example.com AXFR

Answer

named-checkconf /etc/named.conf

Question 27

After a routine kernel update on a RHEL 9 server, the system boots into the new kernel but a critical proprietary storage driver fails to load. As a temporary measure, you need the server to boot the previous (working) kernel by default on every reboot until the vendor releases a fix. Which action accomplishes this persistently?

Accepted Answer

Run 'grubby --set-default' pointing to the previous kernel's vmlinuz path

Answer

Edit the GRUB menu at boot and press Enter on the older kernel entry each time

Answer

Remove the new kernel package with 'dnf remove kernel' to force the old one

Answer

Set 'GRUB_DEFAULT=saved' in /etc/default/grub without running grub2-mkconfig

Question 28

A system administrator is about to run a large package upgrade on a server whose root filesystem is Btrfs. Before proceeding, they want the ability to instantly roll back the root subvolume to its current state if the upgrade breaks the system. Which command creates a point-in-time snapshot of the current root subvolume that can later be used for rollback?

Accepted Answer

btrfs subvolume snapshot / /.snapshots/root-pre-upgrade

Answer

btrfs filesystem defragment -r /

Answer

btrfs balance start /

Answer

btrfs device add /dev/sdb1 /

Question 29

A contractor's access must be automatically disabled after their contract ends on 2026-12-31. You have created their account 'jdoe' and need to configure the account so that login is completely disabled after that date, without deleting the account or its files. Which command accomplishes this?

Accepted Answer

chage -E 2026-12-31 jdoe

Answer

chage -M 2026-12-31 jdoe

Answer

usermod -f 2026-12-31 jdoe

Answer

passwd -x 2026-12-31 jdoe

Question 30

A web server administrator runs firewalld on a RHEL 9 host. They temporarily allowed HTTPS traffic during testing with 'firewall-cmd --add-service=https', which worked correctly. However, after rebooting the server, external clients can no longer reach the site on port 443. What should the administrator do to allow HTTPS traffic to survive reboots?

Accepted Answer

Run 'firewall-cmd --permanent --add-service=https' and then 'firewall-cmd --reload'

Answer

Run 'firewall-cmd --add-service=https --timeout=0' to make the rule persistent

Answer

Edit /etc/services to change the port mapping for HTTPS and restart the network

Answer

Run 'systemctl enable firewalld' so the current ruleset is saved automatically

Question 31

A server was previously configured to boot into a graphical desktop, but after installing a headless monitoring role you want it to boot into a text-based multi-user environment by default. Which command correctly sets this as the persistent default boot target on a systemd-based system?

Accepted Answer

systemctl set-default multi-user.target

Answer

systemctl isolate multi-user.target

Answer

systemctl enable multi-user.target

Answer

systemctl mask graphical.target

Question 32

You added a new partition /dev/sdb1 to a database server and need to incorporate it into an existing volume group named 'vg_data' so you can later extend logical volumes. Before the partition can be added to the volume group, which command must you run first?

Accepted Answer

pvcreate /dev/sdb1

Answer

vgcreate /dev/sdb1

Answer

lvextend /dev/sdb1

Answer

mkfs.ext4 /dev/sdb1

Question 33

A systems administrator has a Btrfs filesystem mounted at /mnt/data (device /dev/sdb1). They want to isolate application logs into a dedicated Btrfs subvolume named 'logs' so it can later receive independent snapshots, and then mount that subvolume at /var/applog. Which sequence of commands accomplishes this correctly?

Accepted Answer

btrfs subvolume create /mnt/data/logs, then mount -o subvol=logs /dev/sdb1 /var/applog

Answer

mkfs.btrfs -L logs /dev/sdb1, then mount /dev/sdb1 /var/applog

Answer

lvcreate -n logs -L 10G btrfs_vg, then mount /dev/btrfs_vg/logs /var/applog

Answer

btrfs device add /dev/sdb1 /var/applog, then btrfs subvolume snapshot /mnt/data /var/applog

Question 34

A database server has a volume group named 'vg_data' with 200 GB of free extents. You need to provision a new 50 GB logical volume called 'lv_backups' that you will format and mount later. Which command creates this logical volume from the existing volume group?

Accepted Answer

lvcreate -L 50G -n lv_backups vg_data

Answer

vgcreate -L 50G -n lv_backups vg_data

Answer

pvcreate -L 50G -n lv_backups vg_data

Answer

lvextend -L 50G -n lv_backups vg_data

Question 35

You added a new disk (/dev/sdb) to a database server and created a single ext4 partition at /dev/sdb1. The team wants the filesystem to mount automatically at /data on every boot, and they warn that device names may shift if disks are added later. After running mkfs.ext4 /dev/sdb1 and creating /data, which approach ensures a reliable persistent mount?

Accepted Answer

Add a line to /etc/fstab referencing the partition by its UUID (from blkid), then run mount -a to verify

Answer

Add a line to /etc/fstab using /dev/sdb1 as the device, then reboot to apply the change

Answer

Run mount /dev/sdb1 /data once; systemd will remember the mapping automatically on subsequent boots

Answer

Create a symlink from /dev/sdb1 to /data and add it to /etc/rc.local

Question 36

A server running low on memory needs additional swap space, but all disk partitions are already allocated and cannot be repartitioned. As the administrator, you decide to add a 2 GB swap file at /swapfile that will be active immediately and remain enabled after reboot. Which sequence of commands correctly accomplishes this?

Accepted Answer

dd if=/dev/zero of=/swapfile bs=1M count=2048; chmod 600 /swapfile; mkswap /swapfile; swapon /swapfile; then add '/swapfile none swap sw 0 0' to /etc/fstab

Answer

fallocate -l 2G /swapfile; mount /swapfile /swap; swapon -a; then add '/swapfile /swap swap defaults 0 0' to /etc/fstab

Answer

mkswap -f /swapfile 2G; chmod 777 /swapfile; swapon --show; then add '/swapfile swap swap auto 0 0' to /etc/fstab

Answer

dd if=/dev/zero of=/swapfile bs=1M count=2048; swapon /swapfile; systemctl enable swapfile.service

Question 37

A system administrator wants to migrate a nightly backup script from a cron job to a systemd timer. They have already created /etc/systemd/system/backup.service (a oneshot unit that runs the script) and /etc/systemd/system/backup.timer with an appropriate OnCalendar= directive. After reloading the systemd daemon, which command will activate the timer so it triggers on schedule AND persists across reboots?

Accepted Answer

systemctl enable --now backup.timer

Answer

systemctl start backup.service

Answer

systemctl enable --now backup.service

Answer

systemctl restart backup.timer

Question 38

A Linux server suddenly loses connectivity to a single peer host (10.0.5.20) on the same subnet, while all other hosts on that subnet remain reachable. Ping to 10.0.5.20 fails, but the interface is up and the default route is intact. You suspect the peer's NIC was recently replaced. Which command output would most directly confirm that a stale link-layer mapping is causing the failure?

Accepted Answer

ip neigh show — displaying 10.0.5.20 with a stale/incomplete MAC entry

Answer

ss -tunap — showing no listening sockets bound to 10.0.5.20

Answer

dig 10.0.5.20 — returning an NXDOMAIN response

Answer

ethtool eth0 — reporting the link speed as auto-negotiated

Question 39

After a kernel update, a RHEL 9 server fails to boot. The console displays a kernel panic with the message: 'VFS: Unable to mount root fs on unknown-block(0,0)'. You boot into the previous working kernel entry from the GRUB menu, and the system starts normally. Comparing /boot, you notice the initramfs file for the new kernel is 0 bytes. What is the most appropriate action to fix booting into the new kernel?

Accepted Answer

Reinstall the kernel package and regenerate the initramfs with 'dracut -f --kver <new-kernel-version>', then update GRUB

Answer

Run 'dracut --force /boot/initramfs-$(uname -r).img $(uname -r)' after booting the new kernel version to regenerate the initramfs

Answer

Edit /etc/fstab to change the root filesystem entry to use the device path instead of the UUID

Answer

Run 'grub2-mkconfig -o /boot/grub2/grub.cfg' to rebuild the boot menu and point it at the working kernel

Question 40

A web application server suddenly fails to connect to an external API, logging TLS errors like 'certificate is not yet valid'. The certificate has a valid date range confirmed by the API vendor, and DNS resolves correctly. You run 'timedatectl' and see the local time is set several days in the past, with NTP synchronization inactive. What is the MOST likely root cause of the connection failure?

Accepted Answer

The server's system clock is skewed into the past, so the certificate's validity start date is in the future relative to the server, causing validation to fail

Answer

The API vendor's certificate chain is missing an intermediate CA that must be installed in the local trust store

Answer

The firewall is blocking outbound port 443, preventing the TLS handshake from completing

Answer

The server's /etc/resolv.conf points to a stale DNS cache returning an outdated certificate fingerprint

Question 41

A user reports that a newly provisioned Linux server can reach other hosts on its local subnet (192.168.10.0/24) but cannot reach any external hosts or the internet. Name resolution using an external DNS server also fails. You log in and run 'ping 8.8.8.8', which returns 'connect: Network is unreachable'. Which command output would most directly confirm the root cause of this problem?

Accepted Answer

ip route show — to verify whether a default gateway route exists

Answer

ss -tulpn — to verify which services are listening on the server

Answer

cat /etc/resolv.conf — to verify the configured DNS nameservers

Answer

ethtool eth0 — to verify the link speed and duplex settings

Question 42

A server hosting a software RAID 1 array (/dev/md0 built from /dev/sdb1 and /dev/sdc1) is still online but users report degraded performance. You suspect a disk problem. Which command will confirm whether the array is running in a degraded state and identify the failed member?

Accepted Answer

cat /proc/mdstat

Answer

lsblk -f /dev/md0

Answer

blkid /dev/sdb1 /dev/sdc1

Answer

fsck -n /dev/md0

Question 43

A web server's root filesystem is reporting 100% full, causing application errors. You delete a large 8 GB log file at /var/log/app/huge.log, but `df -h` still shows the filesystem as full. `du -sh /var/log/app` no longer accounts for the file's size. What is the most likely reason the space has not been reclaimed, and how can you confirm it?

Accepted Answer

A process still holds the deleted file open; run `lsof +L1` (or `lsof | grep deleted`) to find it and restart or signal that process to release the file handle.

Answer

The filesystem journal is corrupted; run `fsck` on the mounted root filesystem to reclaim the orphaned blocks immediately.

Answer

The inode table is exhausted; run `df -i` and delete additional small files to free inodes before space is returned.

Answer

The deletion is cached in the page cache; run `sync && echo 3 > /proc/sys/vm/drop_caches` to flush it and recover the disk space.

Question 44

A web application managed by the systemd unit 'appd.service' fails to start after a configuration change. Running 'systemctl status appd.service' shows the unit is in a 'failed' state with exit code 1, but the truncated output does not reveal the underlying cause. Which command will show the complete log output specific to this unit's most recent start attempt?

Accepted Answer

journalctl -u appd.service -e

Answer

journalctl -f

Answer

systemctl show appd.service

Answer

dmesg | grep appd

Question 45

A user reports that files on a secondary data disk mounted at /data are intermittently unreadable, and dmesg shows repeated 'EXT4-fs error' messages referencing bad block references and directory corruption. The disk passes a SMART self-test with no reallocated sectors. You need to repair the filesystem structure safely. Which approach should you take?

Accepted Answer

Unmount /data, then run 'fsck.ext4 -f /dev/sdb1' to force a full consistency check and repair

Answer

Run 'fsck.ext4 -f /dev/sdb1' while /data remains mounted so users can keep working during the repair

Answer

Run 'mkfs.ext4 /dev/sdb1' to rebuild the filesystem and clear the corruption

Answer

Remount /data read-only with 'mount -o remount,ro /data' and run 'tune2fs -c 1 /dev/sdb1'

Question 46

A mail relay server suddenly refuses to write new files, and applications report 'No space left on device' errors. However, a colleague runs 'df -h' and reports that the root filesystem shows 47% used with plenty of gigabytes free. The /var/spool/mail directory contains millions of tiny message files. What command should you run to confirm the true cause of the write failures?

Accepted Answer

df -i to check inode utilization on the filesystem

Answer

du -sh /var/spool/mail to measure directory size

Answer

lsblk -f to verify the filesystem type and mount status

Answer

fsck -n /dev/mapper/root to scan for block-level corruption

Question 47

A logging daemon on a RHEL 9 server has stopped recording new entries, and several applications report intermittent errors when writing to /var/log. The root filesystem shows plenty of free space when you run 'df -h /'. However, 'df -h /var/log' reveals that /var/log is a separate mount at 100% usage. Before adding storage, you want to reclaim space quickly and safely. Which command gives you the most targeted information to identify what is consuming the space on the /var/log filesystem?

Accepted Answer

du -xh --max-depth=1 /var/log | sort -rh | head

Answer

df -i /var/log

Answer

lsof +L1 /var/log

Answer

find /var/log -mtime +30 -delete

Question 48

Users report intermittent I/O errors when writing to /dev/sdb on a database server. The filesystem occasionally remounts read-only, and journalctl shows repeated 'medium error' and 'unrecovered read error' messages referencing sdb. You suspect the physical drive is failing. Which command gives you the most direct insight into the drive's internal health and reallocated sector counts to confirm hardware failure?

Accepted Answer

smartctl -a /dev/sdb

Answer

fsck -f /dev/sdb1

Answer

badblocks -w /dev/sdb

Answer

iostat -x 5 /dev/sdb

Question 49

Users report that a database server has become extremely sluggish, though the application processes appear healthy. Running 'top' shows CPU usage is mostly idle but the '%wa' (iowait) value is consistently above 40%. You need to identify which physical device is saturated and confirm high disk latency before escalating to the storage team. Which command provides the per-device utilization and average I/O wait/service time you need?

Accepted Answer

iostat -x 2

Answer

vmstat -s

Answer

free -m

Answer

netstat -i

Question 50

A monitoring alert reports that a database server has a load average of 24.0 on an 8-core system, yet top shows CPU usage is only about 15% with over 80% idle. Users report the application feels extremely sluggish. What is the MOST likely cause of the high load average?

Accepted Answer

Numerous processes are stuck in uninterruptible sleep (D state) waiting on blocked I/O

Answer

A single runaway process is consuming all available CPU cycles

Answer

The system is swapping heavily and CPU is spending time in the OOM killer

Answer

The load average calculation is inaccurate and should be ignored on multi-core systems

Question 51

A server fails to complete boot after a power outage. The console shows the system dropping into an emergency shell with the message: 'Failed to mount /data. Dependency failed for Local File Systems.' The root filesystem is mounted read-only. You need to identify the root cause before the system can boot normally. Which command should you run FIRST from the emergency shell to investigate why the /data mount failed?

Accepted Answer

journalctl -xb to review boot messages and locate the specific error for the /data mount unit

Answer

mkfs.xfs /dev/sdb1 to recreate the filesystem on the /data device

Answer

systemctl reboot to force a clean restart of the boot sequence

Answer

passwd root to reset the root password so services can start

Question 52

Users at a branch office report that a web application hosted at the central data center is intermittently slow, with occasional timeouts, while local applications work fine. A ping from a branch Linux host to the data center gateway shows 0% loss, but pings to the application server occasionally drop replies. You need to identify at which network hop packet loss and latency are being introduced along the path. Which command is the BEST tool for this investigation?

Accepted Answer

mtr --report --report-cycles 100 app.datacenter.example.com

Answer

ping -c 100 app.datacenter.example.com

Answer

ss -tunap | grep app.datacenter.example.com

Answer

ip route get app.datacenter.example.com

Question 53

A web application server intermittently becomes unresponsive, and a critical database process is being terminated without an obvious cause. The administrator suspects memory exhaustion. Which command will most directly confirm that the Linux kernel's Out-of-Memory killer terminated the process and identify which process it killed?

Accepted Answer

journalctl -k | grep -i 'out of memory'

Answer

free -h

Answer

top -o %MEM

Answer

vmstat 1 5

Question 54

A newly attached external drive fails to mount. Running 'mount /dev/sdc1 /mnt/backup' returns: 'mount: /mnt/backup: wrong fs type, bad option, bad superblock on /dev/sdc1, missing codepage or helper program, or other error.' The device shows up in 'lsblk', and the partition is healthy. You suspect the kernel does not know how to handle this partition's filesystem. Which command sequence BEST identifies the actual filesystem so you can mount it correctly?

Accepted Answer

Run 'blkid /dev/sdc1' to read the filesystem type, then mount with 'mount -t <type> /dev/sdc1 /mnt/backup', installing any needed userspace helper (e.g., ntfs-3g, exfatprogs)

Answer

Run 'fsck -y /dev/sdc1' to repair the superblock, then retry the mount with default options

Answer

Run 'parted /dev/sdc1 print' to recreate the partition table, then reformat with 'mkfs.ext4 /dev/sdc1'

Answer

Run 'dd if=/dev/zero of=/dev/sdc1 bs=512 count=1' to clear the boot sector, then mount normally

Question 55

A user reports that an internal application server, app.corp.local, is unreachable from a Linux workstation, while other internal hosts work fine. From the workstation, 'ping app.corp.local' returns 'Name or service not known', but 'ping 10.20.5.42' (the server's IP) succeeds. Running 'dig app.corp.local' against the configured DNS server returns NXDOMAIN. Other administrators confirm the DNS record exists and resolves correctly from their machines. What is the MOST likely cause on this workstation?

Accepted Answer

The workstation is querying the wrong DNS server listed in /etc/resolv.conf

Answer

A stale or incorrect entry in /etc/nsswitch.conf is disabling DNS lookups entirely

Answer

The default gateway is misconfigured, blocking all outbound traffic

Answer

The server's firewall is dropping ICMP echo requests by hostname

Question 56

A server that hosts an internal application suddenly loses network connectivity. From the local console, you run 'ip addr show eth0' and see the interface listed with 'state DOWN' and no carrier. The interface has a valid static IP configuration in its NetworkManager profile, and 'systemctl status NetworkManager' shows the service is active. Which command output would BEST confirm whether the physical link between the NIC and the switch is the root cause?

Accepted Answer

ethtool eth0 (check the 'Link detected' field)

Answer

dig @127.0.0.1 internal.example.com

Answer

ss -tulpn | grep :80

Answer

ip route show default

Question 57

Users report that a web application on a Linux server can no longer write files, and application logs show 'Read-only file system' errors. The affected data resides on /dev/sdb1 mounted at /var/www/data. The kernel remounted the filesystem read-only after detecting errors. After confirming the underlying disk is healthy with SMART data, what is the correct sequence to restore normal read-write operation?

Accepted Answer

Unmount /var/www/data, run fsck on /dev/sdb1 to repair the filesystem, then remount it read-write

Answer

Immediately run 'mount -o remount,rw /var/www/data' without unmounting or checking the filesystem

Answer

Edit /etc/fstab to change the mount option to 'rw' and reboot the server

Answer

Delete and recreate the /dev/sdb1 partition with fdisk, then mkfs a new filesystem

Question 58

Users report that a database reporting server has become sluggish. Load average is over 12 on a 4-core system, but free memory is plentiful and disk I/O wait is near zero. You need to quickly identify which single process is consuming the most CPU time in real time so you can decide whether to renice or kill it. Which command gives you this information most directly?

Accepted Answer

top -o %CPU

Answer

free -h

Answer

iostat -x 2

Answer

vmstat 1 5

Question 59

A web application on a Linux server is reachable from the server itself using curl http://localhost:8080, but remote clients on the LAN receive 'connection refused' when connecting to the server's LAN IP on port 8080. Firewall rules have been confirmed to allow the port. Which command output would BEST confirm the root cause of this behavior?

Accepted Answer

ss -tlnp | grep :8080 showing the socket bound to 127.0.0.1:8080

Answer

ping showing the LAN gateway is reachable from the server

Answer

dig +short of the server hostname returning the correct LAN IP

Answer

traceroute from a client showing zero hops of packet loss to the server

Question 60

Users on a Linux workstation report that opening internal web applications by hostname takes 5-10 seconds before loading, while accessing the same sites by IP address is instant. Running 'dig +short intranet.corp.local' against the configured DNS server returns the correct record in under 20 ms. Which action is MOST likely to resolve the delay?

Accepted Answer

Reorder the 'hosts:' line in /etc/nsswitch.conf and reduce lookup timeouts, ensuring the resolver does not attempt an unreachable source (such as mDNS/'mdns4') before falling through to DNS

Answer

Flush the ARP cache with 'ip neigh flush all' to force fresh MAC address resolution

Answer

Increase the MTU on the primary interface to 9000 to speed up large HTTP transfers

Answer

Restart the DNS server daemon because its zone file is returning stale records

Question 61

Users report extremely slow file transfers to a Linux file server, though the connection never fully drops. On the server, 'ping' to the gateway succeeds but shows occasional high latency. You check the interface with 'ip -s link show eth0' and notice a large and growing number of RX errors and collisions. The switch port is configured for 100 Mbps full duplex. What is the MOST likely cause of the poor performance?

Accepted Answer

A duplex mismatch, where eth0 is running half duplex while the switch port is set to full duplex

Answer

The MTU on eth0 is set higher than the switch supports, causing fragmentation

Answer

The DNS resolver is misconfigured, adding latency to each transfer

Answer

The server's default route is missing, forcing traffic through a slower path

Question 62

Users report that a database server has become extremely sluggish, with commands taking many seconds to respond. Running 'vmstat 1' shows sustained high values in the 'si' and 'so' columns (hundreds to thousands per second), while CPU 'us' and 'sy' remain low but 'wa' is elevated. 'free -m' shows almost no free memory and swap nearly full. What is the MOST likely cause of the performance degradation?

Accepted Answer

The system is thrashing because physical memory is exhausted and the kernel is constantly paging to and from swap

Answer

A runaway process is consuming all available CPU cycles in user space

Answer

The disk controller has failed and is returning I/O errors on every read

Answer

The network interface is saturated, delaying client queries

Question 63

A web application on server 'app01' cannot reach a backend API service running on 'db02' at port 5432. From app01 you run 'curl -v telnet://db02:5432' and immediately receive 'Connection refused'. Pinging db02 succeeds and DNS resolves correctly. What is the MOST likely cause?

Accepted Answer

The backend service is not listening on port 5432 on db02

Answer

A firewall rule is silently dropping packets destined for port 5432

Answer

There is high packet loss between app01 and db02

Answer

The MTU is mismatched, causing large packets to be fragmented

Question 64

A monitoring dashboard alerts you that a server has an unusually high process count. Running 'ps aux' shows dozens of entries in the 'Z' state marked '<defunct>'. System memory and CPU usage remain normal, but the total process count keeps climbing. Which action will most effectively eliminate these defunct entries?

Accepted Answer

Identify the parent process and restart or signal it to reap its children

Answer

Send SIGKILL (kill -9) to each defunct process by PID

Answer

Increase the kernel's kernel.pid_max value with sysctl

Answer

Run 'sync' followed by 'echo 3 > /proc/sys/vm/drop_caches'

Exam domain	Exam weight	Practice
System Management	23%	Practice this topic
Troubleshooting	22%	Practice this topic
Services and User Management	20%	Practice this topic
Security	18%	Practice this topic
Automation, Orchestration, and Scripting	17%	Practice this topic

CompTIA Linux+ (XK0-006) (XK0-006) practice exam & study guide

Start studying XK0-006

All XK0-006 study resources

XK0-006 exam domains

Sample XK0-006 questions

Key XK0-006 terms

XK0-006 frequently asked questions

System Management (23%)

Troubleshooting (22%)

Services and User Management (20%)

Security (18%)

Automation, Orchestration, and Scripting (17%)